Which data does the AI see?
The key principle is data minimisation. The AI should only see what it needs for its task. A back-office role needs the enquiries inbox, not payroll.
Where is the data processed?
Clarify in which country and with which provider the processing runs. With every provider that processes personal data on your behalf you need a data processing agreement. With FIDARYN you decide where your business knowledge lives: a German data centre, your own server or a local model.
Is your data used for training?
Ask explicitly. Your customer data does not belong in the training of third-party models. FIDARYN does not give your data to any AI provider for training. The knowledge lives in FIDARYN, not in the model.
Roles and permissions instead of full access
An AI with full access to every application is a risk. Better: every role starts without permissions and only gets what you explicitly grant. Passwords belong in a vault, not in the hands of the AI.
Logs, correction and deletion
You need to be able to trace what happened and to correct and delete data. A log of who, what and when helps with access requests and with internal control.
Involve your staff
Tell your team what the AI is used for. If there is a works council, involve it early. Since 2 February 2025 the EU AI Act also requires businesses to ensure sufficient AI literacy among staff who work with AI.
Checklist before you start
- Purpose and task of the AI defined
- Data scope limited per role
- Place of processing and processing agreement settled
- No training of third-party models with your data
- Approval for important steps, a log for everything
- Correction, export and deletion arranged
- Team informed and trained
This guide gives an overview and does not replace legal advice.
The key point
GDPR compliant does not mean without AI. It means a clear purpose, little data, fixed permissions and a location you decide.